Health Care Legislation Raises Ransomware to Level of Cybersecurity Breach

Data theft and ransomware attacks with a direct financial impact on their victims are some of the primary threats that the health care industry is facing. Healthcare was the most affected sector in terms of cyberattacks in 2015, accumulating a total of 253 security holes and 112 million stolen records.

Despite its long history of lucrative attacks and the thousands of people affected by its intrusions, ransomware was given the same treatment as other infractions in the eyes of the The Health Insurance Portability and Accountability Act of 1996 (HIPAA). This US legislation grants privacy to data and the provision of security to safeguard medical information. Until now, ransomware was part and parcel with the rest of the legislation.

The current scenario calls for greater protection of the multitudes of devices that compose a hospital’s IT infrastructure. The US Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) has declared that ransomware infections constitute a serious violation of the standard. It has been raised to the level of a serious infraction and a breach of cybersecurity.

With the recognition of the activity of encryption (typical of a majority of ransomware incidents) as a form of unauthorized acquisition and diffusion of medical data, ransomware has become subject to HIPPA security rules. This has established the national standards to protect patient information that is stored or transmitted electronically.

Let Us Protect You

If it seems like cybersecurity breaches are a major hassle in themselves, we must now think of the other fiscal penalties that come into play if security protocols are not met. Non-compliance with these protocols could come to light in the event of a cyberattack such as ransomware.

Adaptive Defense 360 is the only advanced cybersecurity system that combines latest generation protection, detection, and remediation technology with the ability to classify 100% of running processes.

This solution classifies all active processes in every endpoint, guaranteeing protection against known malware and against threats such as zero-day attacks, Advanced Persistent Threats, and targeted attacks.

Better to prevent infection now than to cure it later.

The post Health Care Legislation Raises Ransomware to Level of Cybersecurity Breach appeared first on Panda Security Mediacenter.

Apple (iTunes Notify) – Filter Bypass & Persistent Web Vulnerability

Posted by Vulnerability Lab on Jan 16

Document Title:
===============
Apple (iTunes Notify) – Bypass & Persistent Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2024

Followup ID: 654962036

Vulnerability Magazine:
https://www.vulnerability-db.com/?q=articles/2016/12/22/apple-ios-102-notify-function-vulnerable-attacks-idevice-itunes-appstore

Release Date:
=============
2017-01-16

Vulnerability Laboratory ID…

Salesforce (Event Registration) – Persistent Vulnerability

Posted by Vulnerability Lab on Jan 16

Document Title:
===============
Salesforce (Event Registration) – Persistent Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=1991

Release Date:
=============
2017-01-11

Vulnerability Laboratory ID (VL-ID):
====================================
1991

Common Vulnerability Scoring System:
====================================
3.8

Product & Service Introduction:…

Huawei Flybox B660 – (POST SMS) CSRF Web Vulnerability

Posted by Vulnerability Lab on Jan 16

Document Title:
===============
Huawei Flybox B660 – (POST SMS) CSRF Web Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2026

Release Date:
=============
2017-01-12

Vulnerability Laboratory ID (VL-ID):
====================================
2026

Common Vulnerability Scoring System:
====================================
4.4

Product & Service Introduction:…

CVE-2016-7904

Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.

CVE-2017-5223

An issue was discovered in PHPMailer before 5.2.22. PHPMailer’s msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.